A network management system typically comprises at least one network management station which manages one or more network nodes (called "managed nodes"). The management information is exchanged between the management station and the managed nodes. A unit of network management information is referred to as a "managed object." Managed objects that are related are defined in the Management Information Base (MIB). The MIB can be located in a managed node and accessed via a network management protocol, such as SNMP. The management station executes a network management program and each of the managed nodes contains an agent capable of exchanging network management information with the management station.
In a network management system, each managed node is viewed as having a plurality of "variables." By reading (polling) the managed modes to obtain the values of these variables, the management station can monitor the managed nodes. By remotely changing (writing) the values of these variables, a management station can control the managed nodes.
Many common types of network management programs (NMPs) and network management systems (NMSs) do not fully utilize the information available in the managed objects that are gathered from the network nodes. Prior art network management systems and network management programs generally make simple inferences about the network interconnectivity, but not about the need for specific data traffic capacity throughout the network or in a particular node in the network.
Existing network management systems read only a limited subset of MIB information. These systems may be directed to collect specific MIB objects in addition to the MIB objects routinely collected by these systems in order to generate graphical or tabular outputs representing the layout of the network.
The prior art network management systems are capable only of basic analysis and simple remedial action with respect to data traffic in a computer network. For example, network management systems can periodically collect "bad packet" frequency data from a particular port in a network node and compare the rate at which bad packets are received with selected alarm levels, such as a rising threshold alarm level of 10% and a falling threshold alarm level of 5%. An alarm condition is initiated when the error rate increases above the rising threshold alarm level and is terminated when the error rate decreases below the falling threshold alarm level.
However, there are no means for observing a trend in MIB object statistical data, such as bad packet frequency data, that may allow a system operator to take preemptive corrective action or allow the network management system to take preemptive corrective action automatically. Additionally, there are no means for ignoring occasional periods during which a high rate of bad packets are received, rather than generating an alarm. Nor are there means for comparing such occasional periods of high error rate on a particular node with similar periods on similar ports in the same network in order to determine the degree to which these periods are unusual.
Therefore, there is a need in the art for intelligent systems and methods that monitor data traffic in a computer network and detect trends with respect to selected data traffic statistical information. There is also a need in the art for intelligent systems and methods that alert a system operator to a potential problem condition. There is a still further need in the art for intelligent systems that automatically initiate preemptive corrective action in response to a detected trend in the selected data traffic statistical information.